Malaysian banks will never ask for your PIN, TAC, password or card details over SMS, and will never ask you to move money to a safe account. That single rule covers most of the messages currently circulating, and it is the one worth teaching to the people in your family who receive the most of them.

The four tells

  • Urgency with a deadline, such as an account being suspended within 24 hours
  • A link with a slight misspelling of a bank domain, or a shortened URL
  • A sender ID that is ordinary text rather than a five-digit short code
  • A request to call a number in the message rather than the number on your card

Report early. Malaysian banks can sometimes freeze a transfer while it is still in the system, and the first hour matters more than any form filled in later. Save your bank's fraud hotline in your contacts now, before you need it.

If a message makes you feel rushed, that is the scam working. The genuine version never has a countdown on it.

Questions readers ask

What should I do if I already gave them my TAC or PIN?
Call your bank's fraud hotline immediately — the number on the back of your card, not any number from the message. Then call the National Scam Response Centre on 997, which can coordinate a freeze across banks while the money is still in the system. Report it to the police as well, even if nothing has moved yet, because the report is what supports a later claim. Speed matters more than paperwork; the first hour is when a transfer can still be intercepted.
How do I report a scam SMS?
Forward the message to 997 for anything involving a bank or payment app, and block the sender on your phone. You can also report it to MCMC through its complaints portal. Reporting does not recover your money on its own, but it is what gets numbers and sender IDs shut down before the next person receives the same message.

Read next

Where to check this yourself